New, Efficient and Robust, Fiber-Based Quantum Key Distribution Schemes 
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We present a new fiber based quantum key distribution (QKD) scheme which can be regarded 
as a modification of an idea proposed by Inoue, Waks and Yamamoto (IWY) The scheme 
described here uses a single phase modulator and two differential delay elements in series at the 
transmitter that form an interferometer when combined with a third differential delay element at 
the receiver. The protocol is characterized by a high efficiency, reduced exposure to an attack by an 
eavesdropper, and higher sensitivity to such an attack when compared to other QKD schemes. For 
example, the efficiency with which transmitted data contribute to the private key is 3/4 compared 
with 1/4 for BB84 g|. Moreover, an eavesdropper can aquire a maximum of 1/3 of the key which 
leads to an error probability in the private key of 1/3. This can be compared to 1/2 and 1/4 for 
these same parameters in both BB84 and IWY. The combination of these considerations should lead 
to increased range and key distribution rate over present fiber-based QKD schemes. 

PACS Numbers: 03.67.-a, 03.67.Hk, 03.67.Dd, 42.79.Sz 
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The quantum key distribution (QKD) scheme recently 
proposed by Inoue, Waks and Yamamoto jy represents 
a new concept that should prove to be a significant ad- 
vance for fiber-based QKD. Their scheme, which we label 
IWY, is sketched in Fig. [l] for the case of a two delay- 
element transmitter. Essentially, a single pulse entering 
the transmitter leaves as a superposition of three pulses, 
the last two of which have been given a random phase 
shift of A<j) € {0, 7r} relative to the first in addition to 
a fixed time delay of At and 2Ai relative the time as- 
sociated with the input state: The photon pulse is su- 
perposed in time and phase. The receiver effects a time 
delay of At and causes the superposed pulses to overlap 
and hence interfere in the same manner as superposed 
pulses in the standard Franson interferometer [gj used in 
BB84-like fiber QKD as shown in Fig. ||. (The transmit- 
ter and receiver are typically referred to as Alice (A) and 
Bob (B) within the quantum information community.) 

The advantages of this new scheme are numerous: (I) 
the efficiency with which transmitted data contribute to 
the private key, which we label r) p the "protocol effi- 
ciency," is increased to r) p = 1 — l/N, where N is the 
number of temporal superpositions leaving the transmit- 
ter; (II) the amount of information an eavesdropper (E, 
usually Eve) can acquire on the key is reduced as N in- 
creases; (III) the maximum error probability caused by 
eavesdropping, which we name "disturbance" and label 
as pa, increases with N and allows error reconciliation to 
be performed on data with a higher initial error probabil- 
ity; and (IV) B does not need a phase-modulator (PM). 

The implications of these advantages, relating to the 
points raised above, are that A and B generate more key 
and can tolerate and correct for higher error rates be- 
cause: (i) qubits accumulate at a higher rate; (ii) the frac- 
tion of key leaked during eavesdropping, r] e , that must be 
discarded to ensure the privacy is reduced with increas- 
ing N (rj e relates the maximum amount of information E 



can acquire on the quantum key in a specified attack on 
the quantum channel); (iii) the liklihood of detecting E's 
attacks on the quantum channel is increased as her eaves- 
dropping creates a larger disturbance within the qubits; 
and (iv) the random choice of A(j> by B necessary in other 
schemes is eliminated in IWY and yields an increase in rj p 
over these other schemes (r] p increases more than 300% 
for the case of the typical, or current, implementations 
of fiber based BB84, e.g. as shown in Fig. ||). 

A further consequence of removing the PM from the 
receiver is that the typical 3-6 dB loss in PMs is removed 
from B's receiver. Thus, the key rate, robustness against 
errors, and distance over which qubits can be transmitted 
can be enhanced over currently realized fiber based QKD 
systems. 

The scheme we introduce here, and labelled BLT and 
shown in Fig. ^| for two transmitter delay elements, im- 
proves upon IWY in several significant ways while retain- 
ing all of IWY's advantages over other schemes. First, 
BLT is simpler to implement because the series-element 
construction of BLT can be achieved with simple 50/50 
beamsplitters (BSs), while the parallel construction of 
IWY requires more specialized BSs to balance the output 
pulses' intensities. Second, the efficiency (%>), potential 
eavesdropper knowledge (ry e ) and disturbance (pd) all fa- 
vor BLT over IWY for the same number of delay elements 
in the transmitter. In BLT, the number N of superposed 
pulses increases as N — 2 m where m is the number of 
delay elements at the transmitter; in IWY N increases 
as N = m + 1. For example, the serial scheme of BLT 
yields i] p+ > 3/4 while for the parallel scheme of IWY 
Vp\\ > 2/3 with the lower bound given by m = 2 in each 
case. Moreover, the eavedropper's potential information 
i] e is less in BLT than in IWY, and the disturbance pd 
is greater in BLT than in IWY, regardless of the type 
of attack employed by E. Third, a single PM outside 
the transmitter delay elements further reduces the com- 
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plexity and expense of the system and can increase its 
efficiency. For example, it is well-known that QKD is 
more secure and more efficient if each superposition of 
pulses contains exactly one photon. This would most 
likely be realized with a single photon source B before 
the delay elements and appropriately modified optics as 
discussed below. A single PM outside the transmitter de- 
lay elements dramatically increases the receiver efficiency 
in this situation, again due to the typical 3-6 dB loss of 
PMs. 

Consider a fiber BB84 system as shown in Fig. |^ in 
which A sends single, or weak coherent, photon states 
to B fH|||. For each input pulse the phase of A's 
PM is randomly toggled among a choice of four phases: 
<j)A G {0, 7r/2, tt, 37r/2}. As the pulses arrive at B, the PM 
at that end is toggled randomly between cf>B 6 {0, 7r/2} 
for each superposition of pulses to select the measure- 
ment basis for that superposition. (B's delay element 
is adjusted so that a phase difference 4>a — <Pb = 
causes always a photodetection at the same detector and 
§a~4>b = tt causes always a photodetection at the other 
detector.) After the weak pulses are exchanged B re- 
veals the times when photodetections were observed and 
the measurement bases chosen at those times. A notes 
when their phases satisfied 4>a — §b £ {0, 7r}, and tells B 
to discard measurement results which were not collected 
when this condition was satified. What remains is poten- 
tially secret key in which <pA — 4>b S {0, 7r} correspond to 
binary values {0, f }. 

The exchanged qubits will undoubtedly contain errors 
which must be eliminated through an appropriate error 
reconciliation protocol |7p[]. After error reconciliation, 
privacy amplification [B[ - — which is linked to the error 
rate — must be applied to the remaining error-free key 
to reduce E's information to an acceptable level. If the 
error rate is too high all of the remaining key bits may 
be eliminated during this phase. In addition, the channel 
must be authenticated |10(| ; authentication represents an 
additional protocol expense. 

It is worthwhile to note the fraction of key sent by 
A which remains after error reconciliation and privacy 
amplification for each of the schemes discussed here. We 
label this fraction jljj and find 

Rk = V P (Vr - Ve — ), (1) 
Pd 

where p is the measured error probability per bit in the 
key (before error reconciliation), and n r is the fraction of 
B's key material that remains after error reconciliation, 
and depends on p a . The fraction of the distributed key 
that must be discarded through privacy maintenance is 
given by rj e p /pd- Although an additional amount of key 
must be discarded if weak coherent states of light are 
used, this issue is disregarded in the discussion because 
n can be made arbitrarily small (in theory at least), and 
because other states of light can be employed that are not 



susceptible to this type of attack (e.g, entangled photon 
sources ]T^Jl^ |, or other single-photon states jjj). 

Consider the (typical) fiber based BB84 implementa- 
tion described above, and assume that the PM transmis- 
sion is unity. This implementation has a receiver effi- 
ciency ?7p(b b8 4) = 1/40: 1/2 from the 50:50 BS at the 
input of B's delay element and 1/2 due to the random 
bases choice that is crucial to BB84 security. The r/ e and 
Pd depend on the type of attack used by E. The most 
powerful, and yet realistic, attack that has been devised 
for this scheme is for E to intercept and resend the pho- 
ton pulses in the Breidbart Basis (?]]. With this type of 
attack, 7] e < 0.585 and pd = 1/4. If weak coherent pulses 
were used to transmit the key, another fraction n/4 of the 
key is also potentially compromised to E, where n <§; 1 
is the average number of photons per superposition. 

The IWY and BLT schemes accomplish key exchange 
in a similar manner. That is, superposed photon pulses 
(single-photon or weak-coherent states) are transmitted 
from A to B. B's delay element is adjusted so that a 
phase difference A0 6 {0,7r} between adjacent pulses 
in a superposition always cause a photodetection at a 
particular detector. After photodetections are observed, 
B tells A at what times they were observed relative to 
an accepted time standard. Because A knows what the 
phases of each superposition were, A knows which of B's 
detectors registered a photodetection. 

As mentioned previously, 77 p j| = 2/3 while r) p+ = 3/4 
for the implementations of BLT and IWY sketched in 
Figs. |l| and ^ respectively. The strongest attack that can 
be employed by E is likely an intercept/resend attack. 
However, unlike BB84, a Breidbart-like attack is not pos- 
sible in IWY or BLT as the measurements are made in 
orthogonal bases. For these schemes, the strongest in- 
tercept/resend strategy is to build a receiver much like 
B, but to replace the first BS with a fast switch (we do 
not specify the switch technology, but merely state it is 
possible). In this manner, adjacent pulses can be made 
to overlap without loss of signal due to the first or last 
pulse in the superposition contributing less to the inter- 
ference than the central pulses. If exactly one photon 
exists in the superposition E will measure one superposi- 
tion phase difference (A0), but have no knowledge of the 
other remaining phase difference(s). Thus E's knowledge 
of the key for the superpositions that are intercepted and 
resent, and hence rj e can be calculated as r) e \i = 1/2 and 
rj e+ = 1/3 for the IWY and BLT respectively. The cor- 
responding disturbances are Pd\\ = 1/4 and pd+ = 1/3. 
If the effect of multiple photons in a superposition from 
the use of weak coherent states is included, E can know 
another fraction of the key equal to n/4 or n/6 for IWY 
or BLT respectively. 

An important variation to either the IWY or BLT 
scheme is to add a BS and an extra delay element at 
the receiver as shown in (Fig. [|). For this system (de- 
noted with ©), r] p ® = 5/8 while fy e ® = 1/5 is significantly 



reduced, and E's disturbance to the final key is increased 
to as much as pd@ = 2/5, if the additional BS is equally 
reflecting and transmitting. 

With these considerations, r\ p G {1/4,2/3,3/4,5/8} 
and rje/pd G {2.34,2,1,1/2} for {BB84, IWY, BLT and 
BLT©} respectively. The rate at which key is gener- 
ated is proportional to Rk and can be approximated 
from Fig. || where Rk is plotted for the case of pt r = 
1 + (1 -p ) log 2 (l -Po) +Polog 2 (p ): 1 minus the Shan- 
non entropy. 

In any case, in a practical QKD system, Rk will be 
bounded by the values plotted in Fig. |B| for the four 
schemes at the same p . Figure || highlights the value 
of the relative schemes presented here. For p a < 0.13, it 
is clear that BLT has a great advantage over the other 
three schemes: qubits are collected at a higher rate than 
for the other 3 schemes. For p a > 0.13, BLT© retains 
a significant advantage due to its reduced leakage of 
r) e = 1/5, and disturbance pd — 2/5. These facts do 
not consider the added complexity of BLT© at B which 
includes the second delay element and additional detec- 
tors. For simplicity, efficiency, and protection against an 
intercept /resend attack by E, BLT offers great advan- 
tages over BB84, IWY and BLT©. 

In conclusion, we have introduced two new quantum 
key distribution schemes for optical fiber systems based 
on the recently presented idea of Inoue, Waks and Ya- 
mamoto [|l] . Our new schemes are more efficient and ro- 
bust against eavesdropping than other schemes proposed 
to date (BLT© is more efficient than IWY for error rates 
> 2-3%). In particular, BLT also has the advantage of 
being relatively easy and inexpensive to implement. 
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FIG. 1. The IWY parallel-delay element interferometer. 
Alice (A) is on left, Bob (B) on right. A controls all phase 
information (PM;, and PM m ), where the I represents the 
"longer" path and m represents the "medium" path (rela- 
tive to the "short," or direct path). A randomly toggles <f> m 
and <f>i between values of and n. 



Superposed pulse 



A<p 23 
A<p 34 /J A<p 12 

q> 4 A/|Ar|A/|Af(p ^ 




Single pulle r:-. ■(.• 1 ~ 1 "' ;i ' ) ) f^m 1K ' kvl " ls 

FIG. 2. The BLT series-delay element interferometer. A 
is on left, B on right. A controls all phase information by 
randomly adding a phase value of or n to each of the four 
temporal superposition locations. 
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FIG. 3. Fiber based BB84-like transmitter and receiver. A 
is on left, B on right. The phase modulator at A is randomly 
toggled between one of four phases: (j>A G {0, 7r/2, 7r, 37r/2}, 
and at B between one of two phases: <j>B G {0, 7r/2}. 
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FIG. 4. A BLT series-delay interferometer variation with 
increased disturbance and reduced potential eavedropper in- 
formation. A is on left, B on right. This system increases the 
eavesdropping disturbance to as much as 2/5 and reduces E's 
information on the quantum key to a maximum of 1/5. 
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FIG. 5. Fraction of transmitted qubits which contribute to 
private key when privacy amplification is considered. This 
plot clearly shows that the series element idea has a great 
advantage over BB84, IWY, or BLT© for error rates les than 
about 0.13. (The values presented here assume true sin- 
gle-photon QKD and do not consider weak coherent attack 
strategies, or the amount of key lost through error reconcili- 
ation.) 



